ICANN issues breach notice to 130th oldest domain registrar

ICANN has issued a formal breach notice to Netpia, one of the internet’s earliest accredited domain registrars, citing multiple compliance failures. The notice, sent on September 25, requires the South Korea-based company to address outstanding issues by October 16 or risk further enforcement action.

Netpia, which holds IANA ID #130, operates with a relatively small portfolio compared to major registrars like GoDaddy or MarkMonitor. As of May 2026, it managed fewer than 6,000 .com domain registrations, focusing primarily on country-code top-level domains (ccTLDs). Despite its long-standing accreditation, the registrar has fallen behind on several regulatory obligations.

What triggered the breach notice

The ICANN notice outlines four key violations. First, Netpia has failed to pay its accreditation fees, a requirement for maintaining registrar status. Second, the company has not implemented a compliant Registration Data Access Protocol (RDAP) service, which is mandated for all registrars to provide standardized access to domain registration data. Third, ICANN found that Netpia lacks a valid process for handling requests for non-public registration data, a critical function for legal and security investigations. Finally, the registrar’s website is missing required information, including designated abuse contacts, which are essential for addressing malicious activity.

ICANN has set a 21-day deadline for Netpia to remedy these issues. The notice does not specify what consequences the registrar might face if it fails to comply, but ICANN’s enforcement options typically include suspension or termination of accreditation.

Why this matters for the industry

While Netpia’s scale is modest, the breach notice highlights ongoing challenges in registrar compliance, particularly among smaller or legacy providers. RDAP adoption has been a persistent issue since ICANN mandated its use in 2019, replacing the older WHOIS protocol. Registrars that lag in implementing these standards risk operational disruptions, as RDAP is now a core requirement for domain data access.

The notice also underscores the importance of maintaining up-to-date public information, including abuse contacts. For domain investors, corporate registrants, and security teams, the absence of clear abuse reporting channels can complicate efforts to address fraud, phishing, or other malicious activity tied to domains. Netpia’s case serves as a reminder that even long-standing registrars must continuously meet evolving compliance standards to retain their accreditation.

What to watch

The October 16 deadline will determine whether Netpia can resolve the issues without further action from ICANN. If the registrar fails to comply, ICANN may escalate enforcement, potentially leading to suspension or revocation of its accreditation. Such an outcome could impact Netpia’s existing domain registrations, though the scale of disruption would likely be limited given the company’s small customer base.

For other registrars, this notice may prompt internal reviews of compliance status, particularly around RDAP implementation and fee payments. Smaller registrars with limited resources may face similar challenges in keeping pace with ICANN’s requirements, making this a potential bellwether for broader industry compliance trends.